agor-live 0.22.0 → 0.23.2

package/dist/core/drizzle/postgres/0055_app_level_multitenancy_rls.sql

@@ -0,0 +1,411 @@
+-- Enable Postgres row-level tenant isolation for tenant-owned tables.
+--
+-- Static/single-tenant Postgres deployments use the implicit `default` tenant
+-- when `agor.tenant_id` has not been set. Cloud deployments should set
+-- `agor.tenant_id` for each tenant-scoped transaction; app-layer required
+-- mode still fails closed before tenant-owned service access when context is
+-- missing.
+
+ALTER TABLE "sessions" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "sessions" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_sessions" ON "sessions";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_sessions" ON "sessions"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "session_relationships" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "session_relationships" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_session_relationships" ON "session_relationships";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_session_relationships" ON "session_relationships"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "tasks" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "tasks" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_tasks" ON "tasks";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_tasks" ON "tasks"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "serialized_sessions" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "serialized_sessions" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_serialized_sessions" ON "serialized_sessions";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_serialized_sessions" ON "serialized_sessions"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "messages" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "messages" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_messages" ON "messages";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_messages" ON "messages"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "boards" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "boards" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_boards" ON "boards";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_boards" ON "boards"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "repos" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "repos" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_repos" ON "repos";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_repos" ON "repos"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "branches" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "branches" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_branches" ON "branches";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_branches" ON "branches"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "branch_owners" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "branch_owners" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_branch_owners" ON "branch_owners";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_branch_owners" ON "branch_owners"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "board_owners" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "board_owners" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_board_owners" ON "board_owners";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_board_owners" ON "board_owners"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "schedules" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "schedules" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_schedules" ON "schedules";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_schedules" ON "schedules"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "users" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "users" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_users" ON "users";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_users" ON "users"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "groups" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "groups" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_groups" ON "groups";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_groups" ON "groups"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "group_memberships" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "group_memberships" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_group_memberships" ON "group_memberships";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_group_memberships" ON "group_memberships"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "branch_group_grants" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "branch_group_grants" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_branch_group_grants" ON "branch_group_grants";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_branch_group_grants" ON "branch_group_grants"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "board_group_grants" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "board_group_grants" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_board_group_grants" ON "board_group_grants";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_board_group_grants" ON "board_group_grants"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "app_variables" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "app_variables" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_app_variables" ON "app_variables";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_app_variables" ON "app_variables"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "user_api_keys" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "user_api_keys" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_user_api_keys" ON "user_api_keys";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_user_api_keys" ON "user_api_keys"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "mcp_servers" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "mcp_servers" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_mcp_servers" ON "mcp_servers";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_mcp_servers" ON "mcp_servers"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "card_types" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "card_types" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_card_types" ON "card_types";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_card_types" ON "card_types"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "cards" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "cards" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_cards" ON "cards";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_cards" ON "cards"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "artifacts" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "artifacts" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_artifacts" ON "artifacts";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_artifacts" ON "artifacts"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "artifact_trust_grants" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "artifact_trust_grants" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_artifact_trust_grants" ON "artifact_trust_grants";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_artifact_trust_grants" ON "artifact_trust_grants"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "board_objects" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "board_objects" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_board_objects" ON "board_objects";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_board_objects" ON "board_objects"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "session_mcp_servers" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "session_mcp_servers" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_session_mcp_servers" ON "session_mcp_servers";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_session_mcp_servers" ON "session_mcp_servers"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "user_mcp_oauth_tokens" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "user_mcp_oauth_tokens" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_user_mcp_oauth_tokens" ON "user_mcp_oauth_tokens";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_user_mcp_oauth_tokens" ON "user_mcp_oauth_tokens"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "board_comments" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "board_comments" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_board_comments" ON "board_comments";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_board_comments" ON "board_comments"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "gateway_channels" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "gateway_channels" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_gateway_channels" ON "gateway_channels";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_gateway_channels" ON "gateway_channels"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "thread_session_map" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "thread_session_map" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_thread_session_map" ON "thread_session_map";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_thread_session_map" ON "thread_session_map"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "gateway_outbound_messages" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "gateway_outbound_messages" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_gateway_outbound_messages" ON "gateway_outbound_messages";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_gateway_outbound_messages" ON "gateway_outbound_messages"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "session_env_selections" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "session_env_selections" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_session_env_selections" ON "session_env_selections";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_session_env_selections" ON "session_env_selections"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "kb_namespaces" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "kb_namespaces" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_kb_namespaces" ON "kb_namespaces";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_kb_namespaces" ON "kb_namespaces"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "kb_namespace_acl" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "kb_namespace_acl" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_kb_namespace_acl" ON "kb_namespace_acl";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_kb_namespace_acl" ON "kb_namespace_acl"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "kb_documents" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "kb_documents" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_kb_documents" ON "kb_documents";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_kb_documents" ON "kb_documents"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "kb_document_versions" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "kb_document_versions" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_kb_document_versions" ON "kb_document_versions";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_kb_document_versions" ON "kb_document_versions"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "kb_document_units" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "kb_document_units" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_kb_document_units" ON "kb_document_units";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_kb_document_units" ON "kb_document_units"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "kb_embedding_spaces" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "kb_embedding_spaces" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_kb_embedding_spaces" ON "kb_embedding_spaces";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_kb_embedding_spaces" ON "kb_embedding_spaces"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "kb_graph_nodes" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "kb_graph_nodes" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_kb_graph_nodes" ON "kb_graph_nodes";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_kb_graph_nodes" ON "kb_graph_nodes"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+ALTER TABLE "kb_graph_edges" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "kb_graph_edges" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+DROP POLICY IF EXISTS "tenant_isolation_kb_graph_edges" ON "kb_graph_edges";
+--> statement-breakpoint
+CREATE POLICY "tenant_isolation_kb_graph_edges" ON "kb_graph_edges"
+  USING ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+  WITH CHECK ("tenant_id" = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+--> statement-breakpoint
+DO $$
+BEGIN
+  IF to_regclass('public.kb_unit_embeddings') IS NOT NULL THEN
+    ALTER TABLE public.kb_unit_embeddings ADD COLUMN IF NOT EXISTS tenant_id text DEFAULT 'default' NOT NULL;
+    CREATE INDEX IF NOT EXISTS kb_unit_embeddings_tenant_id_idx ON public.kb_unit_embeddings (tenant_id);
+    ALTER TABLE public.kb_unit_embeddings ENABLE ROW LEVEL SECURITY;
+    ALTER TABLE public.kb_unit_embeddings FORCE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS tenant_isolation_kb_unit_embeddings ON public.kb_unit_embeddings;
+    CREATE POLICY tenant_isolation_kb_unit_embeddings ON public.kb_unit_embeddings
+      USING (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+      WITH CHECK (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'));
+  END IF;
+END $$;

package/dist/core/drizzle/postgres/0056_composite_indexes.sql

@@ -0,0 +1,15 @@
+-- Composite indexes to reduce idle-in-transaction window (zombie transaction fix).
+--
+-- session_relationships: tenant+source and tenant+target so the OR predicate
+-- in dispatchCompletionCallbacks uses BitmapOr rather than a full tenant scan.
+--
+-- sessions: (status, ready_for_prompt) for queue-processing queries that
+-- filter on both columns.
+--
+-- tasks: (session_id, created_at) for "latest task for session" lookups used
+-- in completion and heartbeat paths.
+
+CREATE INDEX IF NOT EXISTS "session_relationships_tenant_source_idx" ON "session_relationships" ("tenant_id","source_session_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "session_relationships_tenant_target_idx" ON "session_relationships" ("tenant_id","target_session_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "sessions_status_ready_idx" ON "sessions" ("status","ready_for_prompt");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "tasks_session_created_idx" ON "tasks" ("session_id","created_at");

package/dist/core/drizzle/postgres/0057_message_timestamp_indexes.sql

@@ -0,0 +1,3 @@
+CREATE INDEX IF NOT EXISTS "messages_tenant_timestamp_idx" ON "messages" ("tenant_id","timestamp");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "messages_timestamp_idx" ON "messages" ("timestamp");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "messages_session_timestamp_idx" ON "messages" ("session_id","timestamp");

package/dist/core/drizzle/postgres/meta/_journal.json

@@ -358,6 +358,48 @@
       "when": 1781700000000,
       "tag": "0051_session_relationships",
       "breakpoints": true
+    },
+    {
+      "idx": 51,
+      "version": "7",
+      "when": 1781800000000,
+      "tag": "0052_gateway_outbound_messages",
+      "breakpoints": true
+    },
+    {
+      "idx": 52,
+      "version": "7",
+      "when": 1781900000000,
+      "tag": "0053_user_token_invalidation",
+      "breakpoints": true
+    },
+    {
+      "idx": 53,
+      "version": "7",
+      "when": 1782000000000,
+      "tag": "0054_app_level_multitenancy",
+      "breakpoints": true
+    },
+    {
+      "idx": 54,
+      "version": "7",
+      "when": 1782100000000,
+      "tag": "0055_app_level_multitenancy_rls",
+      "breakpoints": true
+    },
+    {
+      "idx": 55,
+      "version": "7",
+      "when": 1782200000000,
+      "tag": "0056_composite_indexes",
+      "breakpoints": true
+    },
+    {
+      "idx": 56,
+      "version": "7",
+      "when": 1782300000000,
+      "tag": "0057_message_timestamp_indexes",
+      "breakpoints": true
     }
   ]
 }

package/dist/core/drizzle/sqlite/0061_gateway_outbound_messages.sql

@@ -0,0 +1,38 @@
+CREATE TABLE `gateway_outbound_messages` (
+	`id` text(36) PRIMARY KEY NOT NULL,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL,
+	`gateway_channel_id` text(36) NOT NULL,
+	`channel_type` text NOT NULL,
+	`platform_channel_id` text NOT NULL,
+	`platform_message_id` text NOT NULL,
+	`platform_thread_id` text NOT NULL,
+	`platform_permalink` text,
+	`target_branch_id` text(36) NOT NULL,
+	`emitted_by_user_id` text(36) NOT NULL,
+	`emitted_by_session_id` text(36),
+	`emitted_by_task_id` text(36),
+	`emitted_by_schedule_id` text(36),
+	`message_text` text NOT NULL,
+	`message_preview` text NOT NULL,
+	`metadata` text,
+	`consumed_by_session_id` text(36),
+	`consumed_at` integer,
+	FOREIGN KEY (`gateway_channel_id`) REFERENCES `gateway_channels`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`target_branch_id`) REFERENCES `branches`(`branch_id`) ON UPDATE no action ON DELETE no action,
+	FOREIGN KEY (`emitted_by_user_id`) REFERENCES `users`(`user_id`) ON UPDATE no action ON DELETE no action,
+	FOREIGN KEY (`emitted_by_session_id`) REFERENCES `sessions`(`session_id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`emitted_by_task_id`) REFERENCES `tasks`(`task_id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`emitted_by_schedule_id`) REFERENCES `schedules`(`schedule_id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`consumed_by_session_id`) REFERENCES `sessions`(`session_id`) ON UPDATE no action ON DELETE set null
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uniq_gateway_outbound_channel_thread` ON `gateway_outbound_messages` (`gateway_channel_id`,`platform_thread_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_gateway_outbound_emitted_session` ON `gateway_outbound_messages` (`emitted_by_session_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_gateway_outbound_emitted_schedule` ON `gateway_outbound_messages` (`emitted_by_schedule_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_gateway_outbound_branch_created` ON `gateway_outbound_messages` (`target_branch_id`,`created_at`);
+--> statement-breakpoint
+CREATE INDEX `idx_gateway_outbound_consumed` ON `gateway_outbound_messages` (`consumed_at`);

package/dist/core/drizzle/sqlite/0062_user_token_invalidation.sql

@@ -0,0 +1 @@
+ALTER TABLE `users` ADD `tokens_valid_after` integer;

package/dist/core/drizzle/sqlite/0063_composite_indexes.sql

@@ -0,0 +1,10 @@
+-- Composite index to reduce idle-in-transaction window (zombie transaction fix).
+--
+-- sessions: (status, ready_for_prompt) for queue-processing queries that
+-- filter on both columns.
+--
+-- Note: session_relationships and tasks indexes are postgres-only; SQLite
+-- has no tenant_id on session_relationships and the existing source/target
+-- indexes are sufficient.
+
+CREATE INDEX IF NOT EXISTS `sessions_status_ready_idx` ON `sessions` (`status`,`ready_for_prompt`);

package/dist/core/drizzle/sqlite/0064_message_timestamp_indexes.sql

@@ -0,0 +1,2 @@
+CREATE INDEX IF NOT EXISTS `messages_timestamp_idx` ON `messages` (`timestamp`);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `messages_session_timestamp_idx` ON `messages` (`session_id`,`timestamp`);

package/dist/core/drizzle/sqlite/meta/_journal.json

@@ -414,6 +414,34 @@
       "when": 1781700000000,
       "tag": "0060_session_relationships",
       "breakpoints": true
+    },
+    {
+      "idx": 61,
+      "version": "6",
+      "when": 1781800000000,
+      "tag": "0061_gateway_outbound_messages",
+      "breakpoints": true
+    },
+    {
+      "idx": 62,
+      "version": "6",
+      "when": 1781900000000,
+      "tag": "0062_user_token_invalidation",
+      "breakpoints": true
+    },
+    {
+      "idx": 63,
+      "version": "6",
+      "when": 1782000000000,
+      "tag": "0063_composite_indexes",
+      "breakpoints": true
+    },
+    {
+      "idx": 64,
+      "version": "6",
+      "when": 1782100000000,
+      "tag": "0064_message_timestamp_indexes",
+      "breakpoints": true
     }
   ]
 }

package/dist/core/environment/render-snapshot.cjs

@@ -38,10 +38,7 @@ module.exports = __toCommonJS(render_snapshot_exports);
 var import_node_fs = __toESM(require("fs"), 1);
 
 // src/yaml/index.ts
-var import_js_yaml = __toESM(require("js-yaml"), 1);
-var load = import_js_yaml.default.load;
-var dump = import_js_yaml.default.dump;
-var YAMLException = import_js_yaml.default.YAMLException;
+var yaml = __toESM(require("js-yaml"), 1);
 
 // src/config/variant-resolver.ts
 function resolveVariant(env, variantName) {
@@ -195,7 +192,9 @@ function buildBranchContext(branch) {
     unique_id: branch.branch_unique_id,
     name: branch.name,
     path: branch.path,
-    gid: branch.unix_gid
+    gid: branch.unix_gid,
+    base_ref: branch.base_ref || "",
+    ref_type: branch.ref_type || "branch"
   };
   return {
     // Scoped entities (accessible as {{entity.property}})
@@ -251,7 +250,9 @@ function renderBranchSnapshot(repo, branch, variantName) {
     repo_slug: repo.slug,
     custom_context: branch.custom_context,
     unix_gid: branch.unix_gid,
-    host_ip_address: branch.host_ip_address
+    host_ip_address: branch.host_ip_address,
+    base_ref: branch.base_ref,
+    ref_type: branch.ref_type
   });
   const { custom, ...nonCustomBase } = baseContext;
   const overridden = deepMergeContext(

package/dist/core/environment/render-snapshot.d.ts

@@ -52,6 +52,8 @@ export interface RenderBranchInput {
     custom_context?: Record<string, unknown>;
     unix_gid?: number;
     host_ip_address?: string;
+    base_ref?: string;
+    ref_type?: 'branch' | 'tag';
 }
 /**
  * Render a single branch's environment snapshot from a repo's v2

package/dist/core/environment/render-snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-snapshot.d.ts","sourceRoot":"","sources":["../../src/environment/render-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AA6BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,iBAAiB,EACzB,WAAW,CAAC,EAAE,MAAM,GACnB,2BAA2B,GAAG,IAAI,CAyDpC"}
+{"version":3,"file":"render-snapshot.d.ts","sourceRoot":"","sources":["../../src/environment/render-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;CAC7B;AA6BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,iBAAiB,EACzB,WAAW,CAAC,EAAE,MAAM,GACnB,2BAA2B,GAAG,IAAI,CA2DpC"}